@JB211 

Hi,

How are the routers bridged together exactly? Is it via an Ethernet cable that connects from a LAN port of the Archer C6U to a LAN port of the mweb router?

Does the NAS show up in the configuration GUI of the Archer C6U under "Wired Clients" with its IP Address and MAC Address?

  @woozle The archer is connected to the router 2 via wireless bridge wds bridging.the nas does show up under wireless clients list with all the other stuff max and ip's

  @JB211 

WDS is known to have compatibility issues when used to connect devices of different manufacturers. (with "manufacturer" predominantly referring to the designer of the chips and their drivers built inside the router)

By the way, what exactly happens if you connect a Windows computer via the VPN to your Archer C6U and then try to access the NAS with Windows File Explorer via its IP address? (i.e. in Windows File Explorer's address bar type the NAS' address in the format "\\192.168._._"  and then press Enter)

  @woozle i use my laptop via wifi and lte to check this.ran a ip scan on it but couldnt see the router2 ip nor the nas ip, for the heck of it i did try accessing it via name and ip but nope. try getting to router 2 as well but nope. same ip scan on the lan via router 1 i can see router 2 and nas. so hence why i thought it's a routing issue.

You may have difficulty doing this because the ingress and egress traffic is on the same physical (WAN) port of the second router, and you wont have the granular control on the Tplink to override that. But assuming there are no hard-coded firewall rules in the second router to prevent this, you might connect the second router via its WAN port to the Mtik, assign it a static IP on WAN interface, and port forward on the Mitk (DNAT) to the VPN-listening port of the second router's internal WAN IP address. You might also want to set the "double-internal" subnet on the second router to something OTHER than your Mtik subnets.

  @JB211 

Hey, 

I'm also using MWEB as my ISP, and I have that MWEB Nokia modem attached via the WAN port to my TP-Link, and all my other services that I port forward work perfectly, except for the VPN.

Wondering if you had to change anything to get yours working... 

Only thing that might be different is that I am using NOIP for my DNS routing, so that my external IP can change and my port forwarding still works.

  @GilbertLangrial well no.....router one is the main one where the internet starts fibre or whatever means.... the thing is you have to bridge router 2 to 1 then all works including vpn. if yoiu bridge 1 to 2 there is only lan router but no internet return route. you could put in such route if the second router support manual route but thats way to complex. also no lan cables involved. router 2 is bridge via wifi

vpn works well now via any internet connection

@Chilternburt   i also use no-ip, what you forwarding?  say port aaa for ip camera and port yyy to playstation?